Active Directory | Todd's Blog

Upgrading a Windows Server 2003 Domain Controller

posted on May 29, 2015

Customers seem to be finally getting the message about end of support for Windows Server 2003. Support ends in July. (July 14,2015 actually) So I have been assisting customers in preparing for their upgrade.

In most cases, the Server 2003 box is a 32-bit box so the an in-place upgrade path is non-existent. So I have designed steps for a side by each upgrade. The idea here is to bring up a new box on Server 2012, promote it to a domain controller and then demote the old 2003 Server DC.

*Update – One note before you start, you need to be at the Windows 2003 Domain and Forest level.

After installing the domain services role, click in the upper right, then click on Promote this server to a domain controller.

Next fill in the Deployment Configuration options. As you can see , I have selected Add a domain controller to an existing domain, selected a domain and entered my credentials.

Next I observe the settings, enter in a password for Domain Services Restore Mode (don’t lose this password) and click Next

Click Next

Observe settings and click Next

Click Next

After the pre-req checks, click Install

Once this completes, the server will reboot and you’ll have a new Domain Controller running a more modern version of Windows Server.

Next post I’ll cover off demoting the Windows 2003 Server.

Using PowerShell to Get a List of Groups from Active Directory

posted on May 28, 2014

I’ve been busy the past bit manipulating my QA environment to better match the production environment. One of the things I’ve needed to do was pull a list of Active Directory (AD) groups from certain Organizational Units (OUs) and put them into a CSV file where I can then use it to do things like change the email domain, descriptions, etc.

The command you need is as follows, note you need to run this from a machine with the Active Directory PowerShell module installed on it.

$filename = ".\ExportedGroups.csv"
Get-ADGroup -Filter '*' | select-object * | where-object {$_.distinguishedname -like "*,OU=Container,*"} |Export-Csv -Path $filename

What the above script is doing using Get-ADGroup to grab the list of groups, selecting all the fields in the group, using a where-object to figure out which OU we want to use. The OU in this example is container but can be whatever you want or if you have OUs with the same name, then use more of the OU structure like “*,OU=Container,OU=Unique Parent Container,*”.

Finally we export the results to a file named ExportedGroups.csv which is located in the same file as the script.

Setting SPNs and the User Rights Needed

posted on April 10, 2013

One of my co-workers just came over and asked me what are the minimum amount of rights we need to let someone create SPNs (Service Principal Names)?

Good question. Off to TechNet I went looking for the answer. Typically to set SPNs you must be a member of Domain Admins or Enterprise Admins. Alternatively you can set permissions so delegated Admins can set SPNs. The wording from TechNet sounds like this:

If you need to allow delegated administrators to configure service principal names (SPNs), you must ensure that their user accounts have the Validated write to service principal name permission.

The full article can be found at http://technet.microsoft.com/en-us/library/cc731241(v=ws.10).aspx.